SIGSUM-LOG-PRIMARY(1)

✨ NAME ✨

sigsum-log-primary — that's the name, that's the whole name section, and yes she ate: it's the Sigsum log primary. This is the 1 page of the manual, living in User Commands territory, and she is the main character of the log. iykyk 🫶

🦋 SYNOPSIS 🦋

sigsum-log-primary [-?] [--allow-test-domain] [--backend value]
[--external-endpoint host:port] [--internal-endpoint host:port]
[--interval value] [--key-file file] [--log-file file] [--log-level
level] [--max-range value] [--policy-file value] [--rate-limit-file
file] [--secondary-pubkey-file file] [--secondary-url url] [--sth-file
file] [--timeout value] [--trillian-rpc-server host:port] [--trillian-
tree-id-file file] [--url-prefix string] [--version]

okay so it's a lot of flags and the manpage wrapped them, but like, we respect her for it. 🫶

👑 DESCRIPTION 👑

so bestie, here is literally every single thing this command will take, what each one does, and the lil default hanging out in brackets so you know what happens if you say nothing. no gatekeeping, no skipping the "boring" ones, we're doing all of them. 🌸

🎀 the flags, one by one 🎀

• -?, --help — displays the help. that's it, that's the vibe. 💅
• --allow-test-domain — allows submit tokens that come from test.sigsum.org. 🧪
• --backend=value — pick your backend, and it's one of two "trillian" — meaning connect out to an external Trillian server — or "ephemeral" — meaning use the in-memory backend, with NO persistent storage, like genuinely nothing is kept. default [trillian].
• --external-endpoint=host:port — the TCP listen port for serving clients. default [localhost:6965].
• --internal-endpoint=host:port — the internal TCP listen port, for metrics and for replication with the other nodes. default [localhost:6967].
• --interval=value — the interval used to rotate the log's cosigned tree head. default [30s]. ⏰
• --key-file=file — the key file (openssh format), and it's either an unencrypted private key, or a public key that gets accessed via ssh-agent. 🔑
• --log-file=file — the file to write logs to, or stderr if you don't set it.
• --log-level=level — the log level, and the available options are debug, info, warning, error. default [info].
• --max-range=value — the maximum number of leaves that can be retrieved in a single request. default [512].
• --policy-file=value — a policy, which, if provided, defines the witnesses to query.
• --rate-limit-file=file — enables rate limiting, based on the given config file. 🚦
• --secondary-pubkey-file=file — public key for the secondary node.
• --secondary-url=url — the secondary node endpoint, for fetching the latest replicated tree head.
• --sth-file=file — the file where the latest published STH is being stored. default [/var/lib/sigsum-log/sth].
• --timeout=value — timeout for outgoing requests. default [10s].
• --trillian-rpc-server=host:port — TCP port for the Trillian backend server. default [localhost:6962].
• --trillian-tree-id-file=file — the Trillian backend tree identifier. default [/var/lib/sigsum-log/tree-id].
• --url-prefix=string — an optional URL prefix, sitting in front of endpoint names such as /get-tree-head. 🦋
• --version — displays the server version. ✨

and that's the whole page, bestie — every flag accounted for, not one of them left on read. 🎀

this lil masterpiece is sigsum-log-primary 0.15.2-2, dated March 2026, so if you're quoting her, that's the version and that's the month. mwah, go run something iconic. 💖🌈🫶